Privacy Policy

§The short version

• The planner does its work in your browser. Your ports, routes and settings live in your own browser's storage and are not uploaded. The two exceptions are ones you choose: a voyage you save is kept with your account so it opens on every device you sign in on, and a voyage you share by short link is parked on our server so the link stays short (§3).
• Using the planner needs a free account, so we receive your email address — that is the account. Sign-in itself is run by Clerk, our sign-in provider, which holds your password (or your Google sign-in) so that we never do. After you plan your first route we ask a few questions about you — your name, nationality, rank and ship, and, if you choose to answer, your gender and age range (§3). During and after your free trial we send you up to four emails about it, each with a link that stops them, and now and then an email with NaviBoss news, with its own stop link. If a card payment does not go through, or you leave the payment page without paying, we may send you one email about it. We keep a copy of the emails between you and us for 24 months, so we can answer you (§3). We receive a name and payment amount only if you pay us in pesos through /PHcheckout, and what you write only if you start a chat with us. If we offer you a lower price, we keep when your offer started and the one-person code we made for it; if you joined from a crewmate's invite link, we record who invited you (§3). Opening a voyage someone shared with you needs no account at all.
• The only cookies set without asking are the ones that keep you signed in, set by Clerk. Two optional outside tools can run — the Meta (Facebook) pixel and PostHog product analytics — and each loads only if you say yes to it, never before. If you say yes to the Meta pixel and then create an account or buy a plan, our server also tells Meta about it, with a scrambled copy of your email address (§4). Our host, Cloudflare, also counts visits to the site — which pages are opened, from where, and how fast they load — without a cookie and without recognising you, so that one runs without asking (§3). On the payment pages, which our payment provider runs, Google Analytics, Google Tag Manager and the Meta pixel measure checkouts and purchases without asking, with no email or name (§4). Boss, the assistant behind the chart's Boss button, is ours and loads only when you press it: what you write to it is answered by an AI service (Anthropic) and can be read by the NaviBoss team, who may join the conversation. A port tip you post is public, shown with your rank and ship type but never your name, and is checked by the same AI service first.
• You can withdraw a yes at any moment, from the Cookie settings link — in the footer of every page for the pixel, and in the planner for analytics and chat. Turning a tool off also deletes the cookies it set.
• No adverts are served inside the product, and we do not sell, rent or trade personal data. There is no data broker in this stack.

1Who we are, and how to reach us

NaviBoss (“we”, “us”) operates naviboss.app and is the data controller for the personal data described here, within the meaning of the UK and EU General Data Protection Regulation.

Our registered address is West Boxhill, Talisay City, Cebu, Philippines.

Everything on this page — questions, requests, complaints, and any of the rights in §9 — goes to [email protected], and email is much the fastest way to reach us. We are not required to appoint, and have not appointed, a statutory Data Protection Officer; that address reaches the people who make these decisions.

2What stays on your device — which is most of it

The planner is a static web application. Once the page and its chart data have loaded, routing, chokepoint blocking, zone checks, playback and file export all run on your own machine, with no request back to us. That is a performance decision first — it is what makes NaviBoss usable on ship internet — but the privacy consequence is real and it is the most important thing on this page.

These are stored in your browser's own storage (localStorage, and sessionStorage for the routes open in a tab), under keys beginning naviboss., and are never transmitted:

• the routes open in a tab, the voyage you are currently building, and the passages you have blocked — forgotten when you close the tab;
• a copy of your saved voyages, so they still open when the internet drops (the voyages themselves are kept with your account, §3);
• your settings — vessel details if you entered any, units, coordinate format, clock, default departure, which chart layers start on;
• the day/night theme, the sidebar width, and which overlays are showing;
• the date your free trial started — a fallback for when our server cannot be reached; the trial itself belongs to your account (§3);
• your answer to the cookie banner (naviboss.consent), so we do not ask again;
• which price offers you have already been shown or hidden, so the same one does not keep popping up, and an invite link you arrived with, until your account has accepted it (at most 14 days);
• for Boss, the chat: a question you typed before signing in, so it is waiting in the box afterwards, the page to bring you back to once signed in, and whether its tip has been shown on this visit — all three in that tab only, forgotten when you close it;
• your sign-in session token, if you signed in.

So that the planner opens quickly on a slow connection, and opens at all without one, your browser also keeps a copy of NaviBoss's own files: the planner's program, styles, fonts, images and the coastline it draws, in the browser's cache storage under names beginning nb-. This holds nothing about you — no voyage, no setting, nothing from your account — and the routing network, navigational warnings and other data that needs you to sign in are never kept there. It is replaced as NaviBoss is updated.

Clearing your browser storage erases all of it. The voyages you saved to your account are not affected: they are on our side (§3) and come back the next time you sign in. Sharing a voyage never tells us who you sent it to.

3What actually reaches us

Your account — email address, and how you signed in

The planner needs a free account. You sign in with an email address and a password, or with Google. Either way the sign-in is run by our sign-in provider, Clerk (§5), which confirms the address is really yours before the account can be used. Your password goes to Clerk, never to us, and Clerk keeps it only in hashed form. If you choose Google, Google passes Clerk your name, email address and profile picture; we use only the email address. To keep accounts safe, Clerk also records the browser, device, IP address and time of each sign-in, and runs an automated check on new sign-ups to keep bots out.

On our side we keep your email address, when you first signed in (that is when your 7-day trial starts), when you last used the planner, how you signed in, and Clerk's id for your account. We use them to run your trial and to look up whether the address has an active subscription, and — only if you said yes to the Meta pixel — to tell Meta that you created an account, with your email address scrambled (§4). Nothing else. Some sign-ins happen by an emailed one-click link instead; clicking it proves the address is yours in the same way.

Your profile — the questions we ask after your first route

After you plan your first route, the planner asks who you are. We keep your answers with your account: your first and last name, your nationality, where you are now (on board, ashore on leave, working ashore, or still schooling) and your rank, job or what you study. If you choose to give them, we also keep your gender and age range (a range such as "30 to 39", never your date of birth), your ship's name and type, which ECDIS your ship uses, your company, manning agency or school, your years at sea (as a range), the month you expect to join your first ship if you are still schooling, what you will use NaviBoss for, and how you heard about NaviBoss. Every one of these except your name, nationality, where you are and your rank can be skipped.

We ask so that we know who actually uses NaviBoss and can build it for them — which ranks, which kinds of ship, which countries. The answers are stored on our own sign-in service and are read only by us, with one exception you choose: if you post a port tip, your rank and ship type are shown beside it (never your name; see “Port tips” below). They are not sent to PostHog, Crisp or Meta, they are not used for advertising, and they are not sold or shared. To have an answer corrected or deleted, write to [email protected].

Emails about your trial, and the Desktop waitlist

When you make an account we send you up to four emails about your 7-day trial: a welcome, a note two days before it ends, one when it has ended, and one a week after that. They use the email address and first name on your account and the date your trial started. None goes once you have paid, and each carries a Stop these emails link: one press and no more come (sign-in links and receipts still do, when you ask for them). We record which of the four we sent, so none goes twice, and that you pressed stop.

If you joined the Desktop waitlist on our home page, we keep that email address to send you one email when NaviBoss Desktop launches, and use it for nothing else.

When a payment does not go through

Our payment provider, Dodo Payments, tells us about each payment that is started on its checkout: whether it went through, failed, or was left before any card was entered, and with it the email and name typed there, the plan, amount and currency, the billing country, the kind of payment (a card, Google Pay or Apple Pay) and, for a refused card, the reason the bank or Dodo gave (for example "not enough funds"). Never the card number. Two hours after a card is refused, a checkout is left, or a renewal charge fails, we may send you one email from [email protected] saying what happened and what to try. None goes if you have paid since, if you already have a plan (except about a failed renewal of it), or if you stopped the trial emails (again, except about a renewal). At most one every 14 days, and only for a payment made in the last three days. If the address typed at checkout has an obvious slip (such as gmail.xom), we send it to the corrected address and say so. The NaviBoss team gets a note of each one in its Telegram inbox. We record which payments we emailed you about, so that none is emailed twice. To stop them, press Stop these emails in any of our trial emails: that stops these too, except the one about a failed renewal of a plan you have.

NaviBoss news

Now and then we email people with a NaviBoss account about new features, offers and NaviBoss news, from [email protected]. To choose who a news email is for, we use what you told us when you joined (your status, rank, ship type, ECDIS and nationality), your plan, and when you signed up and last used the planner; those answers never leave us. To send a news email to a whole group at once, our email provider Resend keeps a copy of the list: your email address, your first and last name, and which of three groups you are in (paying, in trial, trial ended). Nothing else about you. It holds only people who may get news: if you stop them, an email to you bounces, or you delete your account, you are taken off it the next time we update it, which we do before every news email. Every news email carries its own Stop these emails link: one press and no more news comes, whether the link opens our page or Resend's. That list is separate from the trial emails: stopping one does not stop the other, and emails about your own account (sign-in links, receipts) always still come. We record who each news email went to and whether it was delivered, and that you pressed stop.

Emails between you and us

When you write to [email protected] or [email protected], we keep a copy of your email and any files you attach. We also keep a copy of each email NaviBoss sends you: who it went to, the subject, when, the text, and whether it was delivered or bounced, which our email provider, Resend, tells us. An email carrying a sign-in link is the exception: of those we keep only who, when and the subject, never the link. Only the NaviBoss team sees these copies, beside your account details, so that we can answer you knowing what was said before. We do not track whether you open an email.

A manual-payment claim — only if you use /PHcheckout

Filipino seafarers often hold no international card, so there is a second payment door: pay in pesos by GCash or bank transfer, and we match the payment and unlock the account by hand. Filing that claim sends us the name on the sending account, an email address, the amount, and which of the two methods you used. We deliberately do not ask for a reference number, an ID document, or anything else; if you send us a receipt screenshot over Facebook Messenger, that conversation is held by Meta under its own terms, not ours.

Voyages you save — only the ones you save

When you press Save on a voyage, we keep it with your account, so that it opens on your phone and on the bridge PC alike. A saved voyage holds its name, its ports and stops, the route line itself (so that it never changes on its own), the passages it avoids, its speed and departure time, and, for a route you opened from a file, that file's waypoints. Nothing is saved until you press Save, and Delete in Saved voyages removes it from our server. We use saved voyages only to give them back to you: we do not analyse, share or sell them.

Your free exports this month

On the free plan you can export 1 route, 3 user charts and 1 report a month. To count them on every device, we keep, for this month only, one short line per thing you exported: the month, whether it was a route, a user chart or a report, and a code made from it (so that the same route in another format is not counted twice). The code is not the route: it cannot be turned back into ports or positions. Nothing is kept for paid plans or during the trial, and every line from an earlier month is deleted on the 1st.

Discount offers, and invites from a crewmate

Now and then NaviBoss offers a lower price: as your trial ends, when you come back after a while away, on sale days, or on the free plan. So that an offer is honest (one deadline, which does not start again when you reload, and a price only you can use) we keep with your account when your offer started and when it ends, and the discount code we made for you. That code works once, for one plan, and only at a checkout opened for your account. Some offers are for people who have never subscribed, so we also ask our payment provider, Dodo Payments, whether your email address has had a NaviBoss subscription before, and keep the yes or no. Dodo receives your email address with the code, so that the checkout is yours.

Every account has an invite link. If you sign up from a crewmate's link, we record who invited you (their account and yours), when, and whether you have made your first payment (the fact only: not the amount, and never the card), so that your first month on Monthly is free and your crewmate gets the free month they earned. To give them that month, we ask Dodo Payments to move their next charge one month later. Your crewmate's invite card shows them only how many people joined from their link and how many have paid, never your name or email address; if you are the only one who joined, that count does tell them whether you have paid.

A voyage you share by short link

The Share button copies a short link (naviboss.app/r/…). The voyage behind it — its ports and stops, avoided passages, speed and departure time — is parked on our server under a code made from the voyage itself, so that the link stays short. It carries no name and no email address. If our server cannot be reached, the link carries the whole voyage inside it instead.

Feedback you file — only if you send it

The feedback board at /feedback, and the feedback tab on the chart itself, both post to the same place. What we keep is the title and description you wrote, and an email address only if you chose to give one so we can tell you when the idea ships. Your email is never shown on the board. There is no account behind a post: your browser makes up a random id so it can remember which ideas you have already voted for, and that id means nothing to us beyond stopping double votes.

Feedback sent from the tab on the chart carries a little diagnostic detail with it, so we can make sense of a report without a round of emails: the app version, your browser, and the departure and arrival port of the voyage you had open. This is visible only to us — it is never shown on the public board, and it is never attached to feedback filed from the board page. If you would rather not send it, use /feedback instead of the tab.

A customize request — only if you send one

The form at /customize asks for NaviBoss made to fit a company, a school or you. We keep what you write there: who it is for, what you would like, your message, your name and email address, and, if you give them, your company or school's name, how many people, your country, a phone number, and the chat apps you would like us to reach you on (such as WhatsApp, Viber, Messenger or Telegram) with your number or name on each. We contact you on those apps only about this request. We also keep the country your connection came from, as Cloudflare reports it. You do not need an account to send it. The same details go to the team's support inbox by email and to its private inbox in Telegram (§5), so that we can answer quickly. We use them only to reply to your request and, if you go ahead, to agree and deliver the work. Nothing from this form is shown anywhere or used for news or advertising.

After the form you can book a free call with us. The booking page is Calendly's (§5): it opens only if you press the button, with your name and email already filled in so you do not type them twice. Calendly then holds the booking, sends the invitation to both of us and puts it in our calendar.

Port tips — only if you post one

Signed in, you can post a short tip about a port in the Ports tool’s Tips tab. A tip is public: anyone reading that port sees its text, the month you posted it, and the rank and ship type from your sign-up answers. Your name and email are never shown. Before a tip shows, its text and the port are sent to Anthropic (§5), whose AI checks that it is a tip about the port and does not blame a named person or company or carry a phone number or link; if it refuses, you see why and nothing is shown. Once a port has three tips or more, the same AI writes a short summary of that port’s tips, from their text only. We keep your email with each tip so that we can enforce the limits (5 tips a day, 3 per port), answer a complaint and delete your tips with your account. Readers can report a tip; we keep who reported it so a report counts once, and three reports hide it. The NaviBoss team can hide any tip.

How you use NaviBoss — only if you allow “Product analytics”

If you switch on Product analytics, PostHog (§5) records how you use the site, on every page — the planner, the home page, the checkout and the legal pages: the pages you open and when you leave them, what you click (the element and its label), clicks that did nothing or were repeated in frustration, heat maps of where people click and scroll, how fast pages load, and errors the page runs into. It also makes a session recording — a replay of what was on your screen and how you moved through it — in which everything you type is blanked out (emails, names, search boxes, payment details), and your account email is hidden wherever it is shown. The planner also reports named events: that you planned a route — with its length as a rough band such as “3,000–6,000 nm”, the number of stops, how many passages you avoided and whether you optimised for currents — which tool you opened, that you exported or imported a route file (its format only), copied a share link, saved or opened a voyage, changed the theme or settings, were shown a price offer (which kind) or the home page's “before you go” card, opened, copied or shared your invite link, opened a checkout or signed out. Because a replay shows the screen, it can show the chart and the ports of a voyage you have open. With each event PostHog also receives what any website request carries: your browser and device type, screen size, the page address and the site that referred you, and your IP address, from which it can estimate a country and city. If you are signed in, all of this is linked to your account email, so we can see what customers actually use. We use it only to find what is confusing or broken and to decide what to build; it is not used for advertising and not sold.

Counting visits before sign-up — no cookie, nothing about you

Before you sign in, the planner is a preview you can look around. To know how many people use it, the preview sends our own server a short note at four moments: a tool page opened, the sign-up box opened, the box closed, and a sign-in that came from it — each with the tool’s name and what was pressed. Our server only adds one to a total for that day; it keeps no cookie, no identifier, no IP address and no browser details, so these totals cannot be linked to you or to each other, and they are never shared.

Counting visits to the site — no cookie, nothing that recognises you

Every page of naviboss.app carries Cloudflare Web Analytics, a small script our host Cloudflare adds to the page (§5), so we can see how many people visit, which pages they open and how fast the pages load — including for visitors who decline the optional tools in §4. When a page loads it reports the page address (without anything after a “?”), the site that sent you, your browser, system and device type, the country Cloudflare works out from your connection, and how long the page took to load. It sets no cookie and stores nothing in your browser, and Cloudflare does not use your IP address or browser details to recognise you, so one visit cannot be linked to your next one, to your account, or to you. We see only totals, such as how many times the route planner was opened this week and from which countries. It is not used for advertising and not shared.

Boss, and a chat with us — only if you start one

The Boss button in the planner opens our assistant. When you ask it something we send what you write, the conversation so far, your first name and plan, the ECDIS make you gave when you signed up, whether you are on board, ashore or at school, your rank or job and your ship type (from the questions after your first route), the date and time, which tool you have open, the NAVAREA warnings distance you have set and whether the route on your chart was planned here or opened from a file, to Anthropic, whose AI model writes the answer (§5). For a hard question Boss may ask a more capable Anthropic model for advice, which sees the same conversation. When Boss needs to look at your screen (for example when you cannot find a button), the planner describes it in words, never a picture: the tool and box open, the route on your chart (its ports, distance, speed and departure), the warnings distance and count, the layers that are on, where the chart is looking, and the last few things you did on the page (tools opened, routes planned or opened, file names saved, Settings opened). That list is kept only in the open page and goes nowhere else. When you ask Boss about your own plan, it also sends that plan's details: how you paid, when it started, when it renews or ends, whether it is cancelled, and your NaviBoss Desktop PCs. Never card details (we do not have them) and never your licence key. Anthropic does not use it to train its models. We keep the conversation with your account so you can come back to it, and so the NaviBoss team can help: every message is also copied, with your name and account email, to the team's private inbox in Telegram (§5), and a person from the team may reply in the same chat. If you have left, we email you their reply. You can also attach pictures and files: we keep them with the conversation, a copy goes to the team's Telegram inbox, and when Boss can read one (a picture, a PDF, or the text of a document, spreadsheet, email, route or chart file, for a very big file only its beginning) a copy also goes to Anthropic so that Boss can read it. Anthropic's copy is deleted when that conversation ends, and never kept longer than 30 days. Pictures and files the team sends you are kept with the conversation in the same way. When you ask Boss to plan from or to a place that is not in our port list, we keep the name you asked for with your account, so the team can add it to the list; if Boss then looks it up on the web for you, only the place's name and what narrows it (a country, a nearby port) go to Anthropic's web search, and we keep what it found. You can rate an answer with a thumb; a thumbs-down is shown to the team. If you ask Boss to post an idea to the feedback board, it posts the title and description it showed you, with your account email so we can tell you when the idea ships (the email is never shown on the board). The microphone button types what you say using your browser's own speech service (Google's in Chrome and Edge, Apple's in Safari): your voice goes to that company, not to us, and only the words land in the box, sent when you press Send. Please do not paste or attach anything you would not want us to keep — for example a password, a card number or a photo of your passport. Boss is for help with planning in NaviBoss: like the planner itself, it is not a source of navigational advice, and nothing said in it replaces your charts, notices or the judgement of the officer of the watch.

NaviBoss Desktop — what it sends, and only in Online Mode

The Windows application has two modes. In Offline Mode, and always on a PC you locked offline, it does not connect to the internet and sends nothing to us or anyone else; your voyages and settings stay on that PC. The Microsoft WebView2 component that draws its screens may contact Microsoft when the PC is online (§5).

In Online Mode it connects only to our own servers, and sends:

• your licence key and the PC's Machine ID (a one-way fingerprint of the PC), when you activate it — or the key and the PC's short code, when you activate a PC from your phone at naviboss.app/activate;
• the PC's licence file, which names your account, to sign in to it: there is no separate sign-in in the application;
• requests for the live NAVAREA warnings, security incidents, the marine forecast and the newest version number — the same feeds the website reads;
• the voyages you save, which are then kept with your account as on the website (see Voyages you save, above), with a copy on the PC;
• and, when you use Boss, what is described in the section above.

For each PC we record your email address, its Machine ID or short code, the licence identifier, and when its licence was issued and ends. Each licence file also carries an identifier that links it to your account, so that a licence file found in circulation can be traced. A link you open in the application opens in your own web browser.

Ordinary server logs

The site is served by Cloudflare Pages, and our sign-in service runs on Cloudflare Workers. Like any web host, they process the IP address, request time, page requested and user-agent of each request, for delivery, caching and abuse prevention. Cloudflare shows us traffic totals drawn from them — how many requests, from which countries — but not who made them. We do not build them into profiles.

What we never collect

No passwords — those are held by Clerk, never by us. No payment card numbers — those go to our payment provider and never touch our systems. No location or GPS data: NaviBoss does not ask for your position, and the ports in your voyage are typed by you and stay in your browser — the one exception is the departure and arrival port sent with feedback filed from the chart tab, described above, which happens only when you press that button. No AIS or vessel-tracking data about your ship. No contact list, no camera, no microphone.

4Cookies, storage and optional tools

We set no cookies of our own. The things listed in §2 use localStorage, not cookies. They are strictly necessary for a service you asked for — a planner that forgets your voyage on every reload is not the service — so under the ePrivacy rules they do not require consent, and they cannot be used to track you across other websites.

Signing in uses Clerk's cookies. Clerk's sign-in screen is loaded from clerk.naviboss.app only when it is shown, and it sets the cookies that hold your sign-in — __client on clerk.naviboss.app, and __session and __client_uat on naviboss.app. They do nothing but keep you signed in to the account you asked for, so they are strictly necessary and need no consent; they end when you sign out or your sign-in expires. When a new account is created, Clerk's bot check (Cloudflare Turnstile) also runs.

Our forms that send an email can run the same bot check. When you ask for a sign-in link by email, or send the GCash / bank payment form, Cloudflare Turnstile may check that the request comes from a person and not a script, so that nobody can use those forms to flood strangers' inboxes. It loads from challenges.cloudflare.com only when you use one of those forms, never when a page opens, and usually without asking you anything. Cloudflare says it processes only what that check strictly needs about your browser and does not read what you type into the form. Because it only protects a form you are sending, it is strictly necessary and needs no consent. If it cannot load on a slow or filtered connection, your request still goes through.

Counting visits uses no cookie at all. Cloudflare Web Analytics, described in §3, sets no cookie and writes nothing to your browser's storage, and it cannot recognise you from one visit to the next. That is why it has no switch in the cookie banner: it runs on every page of naviboss.app.

Beyond those, there are three optional outside tools, each with its own switch in the cookie banner and none of them on by default. The Meta pixel can run on any page, and so can PostHog; Crisp runs only in the planner. What they store:

Nothing loads from Meta until you accept. If you have not answered, or you declined, Meta's script is not requested, no cookie is written, and Meta is not told you were here — not by your browser, and not by our server. There is no invisible tracking image anywhere on this site that could fire regardless — we checked, because that is the usual way this promise gets broken.

If you accept, we tell Meta that a page was viewed, and separately when someone opens the planner, creates an account, or starts a checkout (with the price shown for the plan chosen). Your browser never reports a purchase to Meta: our server does (next paragraph), and so can the checkout run by our payment provider, as described below. We have switched Meta's automatic collection off, so the pixel does not read the contents of form fields — your name, email and payment amount on the /PHcheckout form are never sent to Meta by the pixel. What Meta then does with the visit is governed by its own Privacy Policy; on this we and Meta are joint controllers to the limited extent set out in Meta's controller addendum.

When you create an account or buy a plan, our server tells Meta too. Ad blockers and some phones stop the pixel's message that someone signed up, so when you create a NaviBoss account and you have accepted Marketing & measurement, our server sends Meta the same sign-up message once more. Meta counts the two as one. With it go a scrambled (SHA-256 hashed) copy of your email address, the _fbp and _fbc identifiers the pixel stored in your browser, your IP address, your browser's user-agent (its name and version), the time, and the address of the page, with any voyage details cut off. Meta compares the scrambled email with the ones it holds for Facebook and Instagram accounts, to match the sign-up to an advert you saw and to count it once. We never send your email in readable form, your name, your profile answers, or anything about your voyages. If you declined, or never answered, nothing is sent — from your browser or from our server.

A purchase works the same way. If you had accepted Marketing & measurement when you pressed a buy button, our server tells Meta that you bought a plan: by card once our payment provider confirms the payment, or by GCash or bank transfer once we have approved it. So that our server knows you said yes, the buy button carries your answer to the checkout, together with the pixel's _fbp / _fbc identifiers, your browser's user-agent, the time you pressed it and the address of the page (never voyage details); our payment provider keeps them with the payment, and a GCash or bank claim keeps them until we decide it. Meta then receives the plan's amount and currency, a payment reference, a scrambled (SHA-256 hashed) copy of your email address, those identifiers, your user-agent and the time. Not your IP address, your name or anything about your card. Each purchase is reported once, and a renewal is not reported at all. These two, a sign-up and a purchase, are the only events our server reports. If you had not accepted when you pressed the button, nothing about the purchase is sent from our server.

The same rule holds for PostHog and Crisp. Until you allow Product analytics, PostHog's script is not requested and nothing is sent to it. Until you allow Support chat or press the Chat button, Crisp's script is not requested either. Allowing Support chat only means the chat is ready on every visit, so a reply we send while you are away reaches you; without it, the chat still works, and Crisp loads at the moment you press Chat.

Withdrawing is one click, from the Cookie settings link in the footer of every page (product analytics and chat are switched in the planner's own Cookie settings, beside the planner's other links). Withdrawal takes effect immediately, stops further reporting, and deletes that tool's cookies above — it does not merely stop sending while leaving the identifier in place. Turning off Support chat does not end a conversation you started yourself by pressing Chat. It does not undo reporting that already happened; for that, use the deletion rights in §9 and Meta's own Accounts Centre controls.

On the payment pages, our banner does not reach. When you press a buy button you leave naviboss.app for the checkout run by our payment provider, Dodo Payments (§5). For us, Dodo loads Google Analytics, Google Tag Manager and the Meta pixel on its checkout pages, so we can see how many people open a checkout and pay, and which advert or site brought them. They run there without asking first, and they can set their own cookies (_ga from Google, _fbp from Meta). Dodo tells them which plan you are looking at, that you entered payment details, and, if you pay, the amount, the tax, the currency and a payment reference. Dodo sends them no email address, no name and no card details. To keep these out, use a browser or an add-on that blocks trackers: the checkout works without them. What Google and Meta do with this is governed by their own privacy policies.

5Who else is involved

A short list on purpose. Every one of these except Telegram has a written data-processing agreement with us, and none of them is permitted to use your data for their own purposes except where the last column says so. Telegram, which we use as the team's inbox for Boss conversations, does not sign such agreements with its users; we send it only what the team needs to answer you, and we delete it there on the same schedule as our own copy (§7).

We may also disclose data where the law requires it, or to establish or defend a legal claim. If NaviBoss is ever sold, personal data would pass to the buyer under this policy, and we would say so here first.

6Why we are allowed to (lawful bases)

• Performance of a contract — your account (email address and sign-in records) and subscription status, because you asked us for an account, and for access to anything you bought; your saved voyages and short share links, because you asked us to keep them.
• Consent — the Meta pixel, including telling Meta from our server that you created an account or bought a plan (§4), PostHog product analytics, and loading the chat on every visit; each asked for separately. Freely given, specific, informed, and as easy to withdraw as to give.
• Your request — a chat you start by pressing Chat, and our replies to it: we need the conversation to answer you.
• Your request — a port tip you post: you asked us to publish it. The AI check, the limits and reports are our legitimate interest in keeping the tips useful, lawful and free of spam.
• Your request — a customize request: you asked us to reply to it, and, if you go ahead, the steps towards a contract with you.
• Legitimate interests — the anonymous daily totals of preview visits and the cookie-free visit counts from Cloudflare Web Analytics (§3), server logs, keeping the service up, and preventing abuse of the sign-in and claim endpoints, including the bot check on new accounts. We have weighed this against your interests; the data is minimal, is not profiled, and is not combined with anything else.
• Legitimate interests — Google Analytics, Google Tag Manager and the Meta pixel on Dodo's checkout pages (§4): knowing which adverts and sites lead to purchases, so we spend on the ones that work. They get no email, name or card details, and you can block them in your browser without losing the checkout.
• Legitimate interests — your profile answers (§3): knowing who our users are, so that we build the planner for the people who use it. The answers stay with us (except your rank and ship type, shown beside a port tip you choose to post), are not used for advertising, and you can object or have them deleted at any time (§9).
• Legitimate interests — the emails about your trial (§3): telling you what you signed up for, when it ends and what it costs to keep. At most four, never once you have paid, and every one carries a link that stops them for good.
• Legitimate interests — NaviBoss news emails (§3): telling the people who use NaviBoss about what is new in it. Only to people with a NaviBoss account, and every one carries a link that stops them for good, separately from the trial emails.
• Consent — the Desktop waitlist: you gave us the address to be told when that edition launches, and for nothing else.
• Performance of a contract — an offer you take up and its code, and the invite records (§3), because you asked for that price or for the free months.
• Legitimate interests — choosing which price offer to show you, from when your trial ends, when you last used the planner, and whether you have subscribed before (§3): offering lower prices fairly, to the people they are meant for. Nothing else about you is used for it, and an offer is never more than a price you may ignore.
• Legitimate interests — copies of the emails between you and us (§3): answering you with what was said before in front of us, and knowing whether an email reached you. Seen only by the NaviBoss team, never used for advertising, deleted after 24 months.
• Legal obligation — keeping records of payments for as long as tax and accounting rules require.

The planner is free. The personal data it asks for is the email address your account is made of, and the profile answers described in §3. Opening a voyage someone shared with you by link needs no account and no personal data at all.

7How long we keep it

• Your account (free or paid) — until you ask us to delete it. Write to [email protected] and we delete it at Clerk and in our own records, profile answers included.
• Saved voyages — until you delete them, or your account is deleted.
• Port tips — shown while they are live; kept, with who reported them, until you ask us to delete them or your account is deleted. Refused tips are kept the same way, visible only to us.
• Customize requests — while we are talking about the work, and never longer than 24 months after your last message about it, unless it becomes a contract (then as long as its records must be kept). Deleted earlier on request.
• Free export counts — for the current month only; deleted on the 1st.
• Price offers — when each started and ended: until your account is deleted, so that a deadline cannot start again. The codes we made: forgotten when their offer ends, or 30 days after we made them when the offer has no end, and a code that was never used is then deleted at Dodo Payments too. Whether you have subscribed before: until your account is deleted, checked again from time to time.
• Invite records — who invited whom, and whether the free month was given: while either account exists, so that a free month is counted once.
• Which trial emails we sent you — 30 days, then deleted. That you stopped them — kept, because it is what keeps them stopped.
• Which payments we emailed you about (when a payment did not go through) — 180 days, then deleted automatically.
• Which news emails we sent you — 24 months, then deleted. That you stopped them — kept, because it is what keeps them stopped.
• Resend's copy of the news list — while you may get news; taken off it before the next news email once you stop them, an email to you bounces, or your account is deleted.
• The Desktop waitlist — until we have sent the launch email, then deleted.
• Emails between you and us — 24 months, then deleted with their attachments. Sooner if you ask (§9).
• Short share links — kept, so that a link you sent keeps opening. They contain no name or email address.
• Sign-in and subscription records — for as long as the subscription is live, and for 12 months afterwards so that a returning customer is recognised. Then deleted.
• Manual-payment claims — 180 days after the claim is approved or refused, as the receipt trail for a payment that was matched by hand. Then deleted automatically.
• Payment and tax records — as long as the applicable tax law requires, typically several years, held by our payment provider.
• Server logs — the short retention our host applies, on the order of days, not months.
• Visit counts (Cloudflare Web Analytics) — in full detail for 7 days, then reduced to a sample of about one in ten; we can look back 6 months.
• Checkout measurement — in Google Analytics, 2 months for anything tied to a browser, then only totals; at Meta, under Meta's own retention rules.
• The sign-up and purchase messages to Meta (§4) — we do not keep a copy. We keep a note that each was sent, so that it is sent only once: for a sign-up with your email address, for 7 days; for a purchase with its payment reference, for 8 days. What your buy button handed to the checkout stays with the payment at Dodo Payments for as long as it keeps its payment records, and on a GCash or bank claim for as long as we keep the claim. Meta keeps what it received under its own retention rules.
• Product analytics events — for as long as they help us understand how the planner is used, and never longer than 24 months. Deleted earlier on request.
• Boss conversations — deleted automatically, the team's Telegram copy included, once 24 months have passed since your last message to Boss; any single message is deleted when it is 24 months old. The pictures and files in a conversation go with it. Anthropic's copy of a file goes when its conversation ends, and after 30 days at most. A file attached but never sent is deleted after a day. Deleted earlier on request: write to [email protected].
• Earlier chat conversations (Crisp, before 13 October 2026) — while they are useful for supporting you, and never longer than 24 months after the last message. Deleted earlier on request.
• Your consent record — in your browser only, until you clear it.

8When data leaves the EEA or the UK

We are not based in the EEA, and neither are all of the providers in §5. Where personal data of someone in the EEA or the UK is transferred outside it, that transfer is covered by the European Commission's Standard Contractual Clauses (with the UK Addendum where the UK GDPR applies), which is the mechanism each of those providers offers. You may ask us for a copy of the relevant clauses.

In particular, PostHog stores our product analytics in the United States, under those clauses. Anthropic processes Boss conversations in the United States, under those clauses. Google and Meta, which measure the checkout pages, process that data in the United States, under the same clauses; so does Meta for what the pixel and our server's sign-up and purchase messages send it from naviboss.app (§4). Calendly, which books a call after a customize request, is in the United States, under the same clauses. Telegram, our team inbox, stores messages on servers in several countries. Crisp is a French company and hosts chat data in the Netherlands, inside the EEA.

9Your rights, and how to use them

If the UK or EU GDPR applies to you, you have the right to ask us for a copy of your personal data, to have it corrected, to have it deleted, to restrict or object to how we use it, to have it sent to you or another provider in a portable form, and — where we rely on consent — to withdraw that consent at any time without affecting what was lawful before you did.

To use any of them, email [email protected]. We answer within one month, free of charge. We will ask you to confirm you control the email address in question, because that address is the only identifier we hold — we cannot look you up any other way, and we will not accept a request to delete someone else's data.

Your saved voyages you can delete yourself, one by one, in Saved voyages; deleting your account deletes all of them. Everything else in §2 — your open routes and settings — is not ours to export or delete: it is in your browser, and clearing its storage for this site removes it completely.

If you think we have handled your data badly, please tell us first — but you are entitled to complain directly to your national data protection authority. In the UK that is the Information Commissioner's Office; in the EEA it is the supervisory authority for the country you live or work in. In the Philippines it is the National Privacy Commission.

10Children

NaviBoss is a professional tool for people working at sea and ashore, and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, write to [email protected] and we will delete it.

11Changes to this policy

If we change what we collect or who processes it, we will update the date and version at the top of this page. A change that adds a new tracker, or a new purpose for an existing one, will also re-ask for your consent — the banner comes back rather than quietly inheriting your old answer.

This policy sits alongside our Terms & Conditions, which govern your use of the product itself.